CVE-2026-19721: XXE in TÜBİTAK BİLGEM's İmzager
Published Nov 4, 2026
·Updated
Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking.
This issue affects İmzager: from 2.10.5 before 2.10.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
İmzagerto a version that resolves this vulnerability.Fixed in 2.10.7
Event History
Nov 4, 2026
CVE Published
via MITRE·08:12 AM
Data Sourced
via MITRE·08:12 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
İmzager versions from 2.10.5 up to, but not including, 2.10.7 are affected.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access is required and no privileges are required. Exploitation also requires user interaction.
3
What is the security impact?
The issue is rated low severity with a CVSS score of 3.3. It can affect integrity, while confidentiality and availability are not impacted according to the supplied vector.